Reverse Path Filtering (RPF) is a technology that is used on InternetProtocol routers to try and prevent source address spoofing, which is often used for DenialOfService attacks. RPF works by checking the source IP of each packet received on an interface against the routing table. If the best route for the source IP address does not use the same interface that the packet was received on the packet is dropped. There are some situations where this feature will obviously not be the desired behaviour and will need to be disabled. In general if you are not multi-homed then enabling RPF on your router will not be a problem.

Example

Assume a router with the following routing table

Dest

Mask

Interface

10.0.0.0

255.0.0.0

eth0

192.168.0.0

255.255.0.0

eth1

default

*

eth0

A packet arriving at eth0 with a source IP address of 10.10.10.2 would not be dropped, as the best route for 10.10.10.2 is out eth0.

A packet arriving at eth0 with a source IP address of 192.168.40.2 would be dropped as the best route for 192.168.40.2 is out eth1, a different interface to what the packet was received on.

Controlling RPF in Linux

In linux RPF is controlled by the rp_filter kernel option found in /proc/sys/net/ipv4/conf/*/rp_filter. Setting this option to 1 enables reverse path filtering on the specified interface, while setting it to 0 disables it. conf/all/rp_filter must be set to 1 for filtering to work on any interface.

See ip-sysctl.txt in the Documentation directory of the kernel source for more information

Please note that any user can change the contents of pages on this site,
and therefore the Waikato Linux Users Group can offer no assurances that
the information is correct, and the information on this site is not
necessarily the opinion of the Waikato Linux Users Group, or any of its
members. If you have any complaints about the contents of this page,
please do not hesitate to contact the Waikato Linux Users Group, or, click
the Edit button!

Unless otherwise noted, all pages on this site are licensed under the
WlugWikiLicense.